Log in Start free

Vulnerability · Published May 19, 2024 · Assigned by Linux

CVE-2024-35914nfsd: Fix error cleanup path in nfsd_rename()

High 7.5

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 76.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.8.9-1DEBIAN-CVE-2024-35914
Debian:14linux6.8.9-1DEBIAN-CVE-2024-35914
Ubuntu:24.04:LTSlinux6.8.0-38.38UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-aws6.8.0-1011.12UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1011.12~22.04.1UBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-azure6.8.0-1010.10UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-gcp6.8.0-1010.11UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-gke6.8.0-1006.9UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-ibm6.8.0-1008.8UBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-intel6.8.0-1007.14UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-38.38.1UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1009.9UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1009.9~22.04.1UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1008.8UBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-oracle6.8.0-1008.8UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1008.8~22.04.1UBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-raspi6.8.0-1007.7UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-35914
Ubuntu:24.04:LTSlinux-riscv6.8.0-38.38.1UBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-35914
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-35914

Affected products (as reported)

VendorProductVersions
Linux Linux a8b0026847b8c43445c921ad2c85521c92eb175f – before 331e125e02c08ffaecc1074af78a988a278039bda8b0026847b8c43445c921ad2c85521c92eb175f – before 9fe6e9e7b58944037714442384075c17cfde1c56
Linux Linux 6.8

References